Skip to content

Commit 85ed3e7

Browse files
magento-engcom-teammagento-engcom-team
committed
ENGCOM-5295: #486 added customer account validation in Quote operations #714
- Merge Pull Request magento/graphql-ce#714 from vovsky/graphql-ce:486-add-customer-account-validation-in-quote-operations - Merged commits: 1. f91224e 2. 65c6327 3. 0a68474 4. a8ea439 5. d983e25 6. 7fc5494 7. 0890aa8
2 parents bcfe16f + 0890aa8 commit 85ed3e7

28 files changed

+191
-258
lines changed

‎app/code/Magento/CustomerGraphQl/Model/Context/AddUserInfoToContext.php

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,14 +39,27 @@ public function execute(ContextParametersInterface $contextParameters): ContextP
3939
if (null !== $currentUserId) {
4040
$currentUserId = (int)$currentUserId;
4141
}
42+
$contextParameters->setUserId($currentUserId);
4243

4344
$currentUserType = $this->userContext->getUserType();
4445
if (null !== $currentUserType) {
4546
$currentUserType = (int)$currentUserType;
4647
}
47-
48-
$contextParameters->setUserId($currentUserId);
4948
$contextParameters->setUserType($currentUserType);
49+
50+
$contextParameters->addExtensionAttribute('is_customer', $this->isCustomer($currentUserId, $currentUserType));
5051
return $contextParameters;
5152
}
53+
54+
/**
55+
* Checking if current user is logged
56+
*
57+
* @param int|null $customerId
58+
* @param int|null $customerType
59+
* @return bool
60+
*/
61+
private function isCustomer(?int $customerId, ?int $customerType): bool
62+
{
63+
return !empty($customerId) && !empty($customerType) && $customerType !== UserContextInterface::USER_TYPE_GUEST;
64+
}
5265
}

‎app/code/Magento/CustomerGraphQl/Model/Customer/GetCustomer.php

Lines changed: 1 addition & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,6 @@
77

88
namespace Magento\CustomerGraphQl\Model\Customer;
99

10-
use Magento\Authorization\Model\UserContextInterface;
1110
use Magento\Customer\Api\AccountManagementInterface;
1211
use Magento\Customer\Api\CustomerRepositoryInterface;
1312
use Magento\Customer\Api\Data\CustomerInterface;
@@ -18,7 +17,7 @@
1817
use Magento\Framework\GraphQl\Exception\GraphQlAuthorizationException;
1918
use Magento\Framework\GraphQl\Exception\GraphQlInputException;
2019
use Magento\Framework\GraphQl\Exception\GraphQlNoSuchEntityException;
21-
use Magento\Framework\GraphQl\Query\Resolver\ContextInterface;
20+
use Magento\GraphQl\Model\Query\ContextInterface;
2221

2322
/**
2423
* Get customer
@@ -68,11 +67,6 @@ public function __construct(
6867
public function execute(ContextInterface $context): CustomerInterface
6968
{
7069
$currentUserId = $context->getUserId();
71-
$currentUserType = $context->getUserType();
72-
73-
if (true === $this->isUserGuest($currentUserId, $currentUserType)) {
74-
throw new GraphQlAuthorizationException(__('The current customer isn\'t authorized.'));
75-
}
7670

7771
try {
7872
$customer = $this->customerRepository->getById($currentUserId);
@@ -100,19 +94,4 @@ public function execute(ContextInterface $context): CustomerInterface
10094
}
10195
return $customer;
10296
}
103-
104-
/**
105-
* Checking if current customer is guest
106-
*
107-
* @param int|null $customerId
108-
* @param int|null $customerType
109-
* @return bool
110-
*/
111-
private function isUserGuest(?int $customerId, ?int $customerType): bool
112-
{
113-
if (null === $customerId || null === $customerType) {
114-
return true;
115-
}
116-
return 0 === (int)$customerId || (int)$customerType === UserContextInterface::USER_TYPE_GUEST;
117-
}
11897
}

‎app/code/Magento/CustomerGraphQl/Model/Resolver/ChangePassword.php

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,11 @@
1313
use Magento\CustomerGraphQl\Model\Customer\GetCustomer;
1414
use Magento\Framework\Exception\LocalizedException;
1515
use Magento\Framework\GraphQl\Config\Element\Field;
16+
use Magento\Framework\GraphQl\Exception\GraphQlAuthorizationException;
1617
use Magento\Framework\GraphQl\Exception\GraphQlInputException;
1718
use Magento\Framework\GraphQl\Query\ResolverInterface;
1819
use Magento\Framework\GraphQl\Schema\Type\ResolveInfo;
20+
use Magento\GraphQl\Model\Query\ContextInterface;
1921

2022
/**
2123
* Change customer password resolver
@@ -70,6 +72,11 @@ public function resolve(
7072
array $value = null,
7173
array $args = null
7274
) {
75+
/** @var ContextInterface $context */
76+
if (false === $context->getExtensionAttributes()->getIsCustomer()) {
77+
throw new GraphQlAuthorizationException(__('The current customer isn\'t authorized.'));
78+
}
79+
7380
if (!isset($args['currentPassword']) || '' == trim($args['currentPassword'])) {
7481
throw new GraphQlInputException(__('Specify the "currentPassword" value.'));
7582
}
@@ -78,16 +85,16 @@ public function resolve(
7885
throw new GraphQlInputException(__('Specify the "newPassword" value.'));
7986
}
8087

81-
$customer = $this->getCustomer->execute($context);
82-
$customerId = (int)$customer->getId();
83-
88+
$customerId = $context->getUserId();
8489
$this->checkCustomerPassword->execute($args['currentPassword'], $customerId);
8590

8691
try {
8792
$this->accountManagement->changePasswordById($customerId, $args['currentPassword'], $args['newPassword']);
8893
} catch (LocalizedException $e) {
8994
throw new GraphQlInputException(__($e->getMessage()), $e);
9095
}
96+
97+
$customer = $this->getCustomer->execute($context);
9198
return $this->extractCustomerData->execute($customer);
9299
}
93100
}

‎app/code/Magento/CustomerGraphQl/Model/Resolver/CreateCustomerAddress.php

Lines changed: 8 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -9,22 +9,18 @@
99

1010
use Magento\CustomerGraphQl\Model\Customer\Address\CreateCustomerAddress as CreateCustomerAddressModel;
1111
use Magento\CustomerGraphQl\Model\Customer\Address\ExtractCustomerAddressData;
12-
use Magento\CustomerGraphQl\Model\Customer\GetCustomer;
12+
use Magento\Framework\GraphQl\Exception\GraphQlAuthorizationException;
1313
use Magento\Framework\GraphQl\Exception\GraphQlInputException;
1414
use Magento\Framework\GraphQl\Schema\Type\ResolveInfo;
1515
use Magento\Framework\GraphQl\Config\Element\Field;
1616
use Magento\Framework\GraphQl\Query\ResolverInterface;
17+
use Magento\GraphQl\Model\Query\ContextInterface;
1718

1819
/**
1920
* Customers address create, used for GraphQL request processing
2021
*/
2122
class CreateCustomerAddress implements ResolverInterface
2223
{
23-
/**
24-
* @var GetCustomer
25-
*/
26-
private $getCustomer;
27-
2824
/**
2925
* @var CreateCustomerAddressModel
3026
*/
@@ -36,16 +32,13 @@ class CreateCustomerAddress implements ResolverInterface
3632
private $extractCustomerAddressData;
3733

3834
/**
39-
* @param GetCustomer $getCustomer
4035
* @param CreateCustomerAddressModel $createCustomerAddress
4136
* @param ExtractCustomerAddressData $extractCustomerAddressData
4237
*/
4338
public function __construct(
44-
GetCustomer $getCustomer,
4539
CreateCustomerAddressModel $createCustomerAddress,
4640
ExtractCustomerAddressData $extractCustomerAddressData
4741
) {
48-
$this->getCustomer = $getCustomer;
4942
$this->createCustomerAddress = $createCustomerAddress;
5043
$this->extractCustomerAddressData = $extractCustomerAddressData;
5144
}
@@ -60,13 +53,16 @@ public function resolve(
6053
array $value = null,
6154
array $args = null
6255
) {
56+
/** @var ContextInterface $context */
57+
if (false === $context->getExtensionAttributes()->getIsCustomer()) {
58+
throw new GraphQlAuthorizationException(__('The current customer isn\'t authorized.'));
59+
}
60+
6361
if (!isset($args['input']) || !is_array($args['input']) || empty($args['input'])) {
6462
throw new GraphQlInputException(__('"input" value should be specified'));
6563
}
6664

67-
$customer = $this->getCustomer->execute($context);
68-
69-
$address = $this->createCustomerAddress->execute((int)$customer->getId(), $args['input']);
65+
$address = $this->createCustomerAddress->execute($context->getUserId(), $args['input']);
7066
return $this->extractCustomerAddressData->execute($address);
7167
}
7268
}

‎app/code/Magento/CustomerGraphQl/Model/Resolver/Customer.php

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,12 @@
88
namespace Magento\CustomerGraphQl\Model\Resolver;
99

1010
use Magento\CustomerGraphQl\Model\Customer\GetCustomer;
11+
use Magento\Framework\GraphQl\Exception\GraphQlAuthorizationException;
1112
use Magento\Framework\GraphQl\Schema\Type\ResolveInfo;
1213
use Magento\CustomerGraphQl\Model\Customer\ExtractCustomerData;
1314
use Magento\Framework\GraphQl\Config\Element\Field;
1415
use Magento\Framework\GraphQl\Query\ResolverInterface;
16+
use Magento\GraphQl\Model\Query\ContextInterface;
1517

1618
/**
1719
* Customers field resolver, used for GraphQL request processing.
@@ -50,8 +52,12 @@ public function resolve(
5052
array $value = null,
5153
array $args = null
5254
) {
53-
$customer = $this->getCustomer->execute($context);
55+
/** @var ContextInterface $context */
56+
if (false === $context->getExtensionAttributes()->getIsCustomer()) {
57+
throw new GraphQlAuthorizationException(__('The current customer isn\'t authorized.'));
58+
}
5459

60+
$customer = $this->getCustomer->execute($context);
5561
return $this->extractCustomerData->execute($customer);
5662
}
5763
}

‎app/code/Magento/CustomerGraphQl/Model/Resolver/CustomerAddresses.php

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@
88
namespace Magento\CustomerGraphQl\Model\Resolver;
99

1010
use Magento\Customer\Model\Customer;
11-
use Magento\CustomerGraphQl\Model\Customer\GetCustomer;
1211
use Magento\Framework\Exception\LocalizedException;
1312
use Magento\Framework\GraphQl\Schema\Type\ResolveInfo;
1413
use Magento\Framework\GraphQl\Config\Element\Field;
@@ -20,25 +19,17 @@
2019
*/
2120
class CustomerAddresses implements ResolverInterface
2221
{
23-
/**
24-
* @var GetCustomer
25-
*/
26-
private $getCustomer;
27-
2822
/**
2923
* @var ExtractCustomerAddressData
3024
*/
3125
private $extractCustomerAddressData;
3226

3327
/**
34-
* @param GetCustomer $getCustomer
3528
* @param ExtractCustomerAddressData $extractCustomerAddressData
3629
*/
3730
public function __construct(
38-
GetCustomer $getCustomer,
3931
ExtractCustomerAddressData $extractCustomerAddressData
4032
) {
41-
$this->getCustomer = $getCustomer;
4233
$this->extractCustomerAddressData = $extractCustomerAddressData;
4334
}
4435

‎app/code/Magento/CustomerGraphQl/Model/Resolver/DeleteCustomerAddress.php

Lines changed: 8 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -9,22 +9,18 @@
99

1010
use Magento\CustomerGraphQl\Model\Customer\Address\DeleteCustomerAddress as DeleteCustomerAddressModel;
1111
use Magento\CustomerGraphQl\Model\Customer\Address\GetCustomerAddress;
12-
use Magento\CustomerGraphQl\Model\Customer\GetCustomer;
12+
use Magento\Framework\GraphQl\Exception\GraphQlAuthorizationException;
1313
use Magento\Framework\GraphQl\Exception\GraphQlInputException;
1414
use Magento\Framework\GraphQl\Schema\Type\ResolveInfo;
1515
use Magento\Framework\GraphQl\Config\Element\Field;
1616
use Magento\Framework\GraphQl\Query\ResolverInterface;
17+
use Magento\GraphQl\Model\Query\ContextInterface;
1718

1819
/**
1920
* Customers address delete, used for GraphQL request processing.
2021
*/
2122
class DeleteCustomerAddress implements ResolverInterface
2223
{
23-
/**
24-
* @var GetCustomer
25-
*/
26-
private $getCustomer;
27-
2824
/**
2925
* @var GetCustomerAddress
3026
*/
@@ -36,16 +32,13 @@ class DeleteCustomerAddress implements ResolverInterface
3632
private $deleteCustomerAddress;
3733

3834
/**
39-
* @param GetCustomer $getCustomer
4035
* @param GetCustomerAddress $getCustomerAddress
4136
* @param DeleteCustomerAddressModel $deleteCustomerAddress
4237
*/
4338
public function __construct(
44-
GetCustomer $getCustomer,
4539
GetCustomerAddress $getCustomerAddress,
4640
DeleteCustomerAddressModel $deleteCustomerAddress
4741
) {
48-
$this->getCustomer = $getCustomer;
4942
$this->getCustomerAddress = $getCustomerAddress;
5043
$this->deleteCustomerAddress = $deleteCustomerAddress;
5144
}
@@ -60,13 +53,16 @@ public function resolve(
6053
array $value = null,
6154
array $args = null
6255
) {
56+
/** @var ContextInterface $context */
57+
if (false === $context->getExtensionAttributes()->getIsCustomer()) {
58+
throw new GraphQlAuthorizationException(__('The current customer isn\'t authorized.'));
59+
}
60+
6361
if (!isset($args['id']) || empty($args['id'])) {
6462
throw new GraphQlInputException(__('Address "id" value should be specified'));
6563
}
6664

67-
$customer = $this->getCustomer->execute($context);
68-
$address = $this->getCustomerAddress->execute((int)$args['id'], (int)$customer->getId());
69-
65+
$address = $this->getCustomerAddress->execute((int)$args['id'], $context->getUserId());
7066
$this->deleteCustomerAddress->execute($address);
7167
return true;
7268
}

‎app/code/Magento/CustomerGraphQl/Model/Resolver/RevokeCustomerToken.php

Lines changed: 7 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -7,36 +7,29 @@
77

88
namespace Magento\CustomerGraphQl\Model\Resolver;
99

10-
use Magento\CustomerGraphQl\Model\Customer\GetCustomer;
1110
use Magento\Framework\GraphQl\Config\Element\Field;
11+
use Magento\Framework\GraphQl\Exception\GraphQlAuthorizationException;
1212
use Magento\Framework\GraphQl\Query\ResolverInterface;
1313
use Magento\Framework\GraphQl\Schema\Type\ResolveInfo;
14+
use Magento\GraphQl\Model\Query\ContextInterface;
1415
use Magento\Integration\Api\CustomerTokenServiceInterface;
1516

1617
/**
1718
* Customers Revoke Token resolver, used for GraphQL request processing.
1819
*/
1920
class RevokeCustomerToken implements ResolverInterface
2021
{
21-
/**
22-
* @var GetCustomer
23-
*/
24-
private $getCustomer;
25-
2622
/**
2723
* @var CustomerTokenServiceInterface
2824
*/
2925
private $customerTokenService;
3026

3127
/**
32-
* @param GetCustomer $getCustomer
3328
* @param CustomerTokenServiceInterface $customerTokenService
3429
*/
3530
public function __construct(
36-
GetCustomer $getCustomer,
3731
CustomerTokenServiceInterface $customerTokenService
3832
) {
39-
$this->getCustomer = $getCustomer;
4033
$this->customerTokenService = $customerTokenService;
4134
}
4235

@@ -50,8 +43,11 @@ public function resolve(
5043
array $value = null,
5144
array $args = null
5245
) {
53-
$customer = $this->getCustomer->execute($context);
46+
/** @var ContextInterface $context */
47+
if (false === $context->getExtensionAttributes()->getIsCustomer()) {
48+
throw new GraphQlAuthorizationException(__('The current customer isn\'t authorized.'));
49+
}
5450

55-
return ['result' => $this->customerTokenService->revokeCustomerAccessToken((int)$customer->getId())];
51+
return ['result' => $this->customerTokenService->revokeCustomerAccessToken($context->getUserId())];
5652
}
5753
}

‎app/code/Magento/CustomerGraphQl/Model/Resolver/UpdateCustomer.php

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,13 @@
99

1010
use Magento\CustomerGraphQl\Model\Customer\GetCustomer;
1111
use Magento\CustomerGraphQl\Model\Customer\UpdateCustomerAccount;
12+
use Magento\Framework\GraphQl\Exception\GraphQlAuthorizationException;
1213
use Magento\Framework\GraphQl\Exception\GraphQlInputException;
1314
use Magento\Framework\GraphQl\Schema\Type\ResolveInfo;
1415
use Magento\CustomerGraphQl\Model\Customer\ExtractCustomerData;
1516
use Magento\Framework\GraphQl\Config\Element\Field;
1617
use Magento\Framework\GraphQl\Query\ResolverInterface;
18+
use Magento\GraphQl\Model\Query\ContextInterface;
1719

1820
/**
1921
* Update customer data resolver
@@ -60,6 +62,11 @@ public function resolve(
6062
array $value = null,
6163
array $args = null
6264
) {
65+
/** @var ContextInterface $context */
66+
if (false === $context->getExtensionAttributes()->getIsCustomer()) {
67+
throw new GraphQlAuthorizationException(__('The current customer isn\'t authorized.'));
68+
}
69+
6370
if (!isset($args['input']) || !is_array($args['input']) || empty($args['input'])) {
6471
throw new GraphQlInputException(__('"input" value should be specified'));
6572
}

0 commit comments

Comments
 (0)